63acbf6ea9cd2caa9ca549208c68c41b_JaffaCakes118

General

Target

63acbf6ea9cd2caa9ca549208c68c41b_JaffaCakes118
Size

19KB
MD5

63acbf6ea9cd2caa9ca549208c68c41b
SHA1

eda86622a5915e55a7d776b93eaae2e9ced9cbc1
SHA256

3b305d0a2a2541d516fb36aac6eab88badf14c39708e0bc8d4fa44a0fd82ba2a
SHA512

76c5611da0b68e0f0521d8369f261621f059739c7d7f7a7f52c6e3d71079364f7521d62ddec26d44e5afe1d87a995172e6f667549d6d43dbe6c7d0c17d3734a1
SSDEEP

192:rxGJa1CqcrANnY/dZ7JQfuMCSWVMuBBQ6PRQkIU8jXDMcDdsZ:5CfB/TafWSWVMuBBQARQkIHMsds

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63acbf6ea9cd2caa9ca549208c68c41b_JaffaCakes118

Files

63acbf6ea9cd2caa9ca549208c68c41b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

fd599f2e6cd894a5e41124b7f6e65af4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

ntdll

strlen
RtlZeroMemory
strcpy
memcmp
memcpy

kernel32

VirtualProtectEx
LoadLibraryA
GetProcAddress
lstrlenA
lstrcpynA
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatA
CloseHandle
CreateFileA
CreateThread
GetCurrentProcess
GetCurrentProcessId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GlobalAlloc
GlobalFree
ReadFile
ReadProcessMemory
Sleep
TerminateProcess
VirtualAlloc
VirtualFree
WriteProcessMemory
VirtualQueryEx

user32

GetWindowThreadProcessId
KillTimer
SetTimer
SetWindowLongA
SetWindowsHookExA
UnhookWindowsHookEx
GetWindowLongA
GetWindowTextA
EnumWindows
wsprintfA
CallNextHookEx
CallWindowProcA

ws2_32

send
gethostname

Exports

Exports

ServiceRouteEx
StartServiceEx
StopServiceEx

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd599f2e6cd894a5e41124b7f6e65af4

Headers

File Characteristics

Imports

wininet

ntdll

kernel32

user32

ws2_32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.bss Size: - Virtual size: 4B

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 5KB - Virtual size: 4KB

.reloc Size: 1024B - Virtual size: 556B

.text
Size: 8KB - Virtual size: 7KB

.bss
Size: - Virtual size: 4B

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 5KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 556B